Skip to content
shotrecipe

Draft for owner and legal review

Privacy Notice

This notice explains the private-video, analysis, retention, provider, security, and optional analytics data flows implemented in the current ShotRecipe codebase.

Last updated August 27, 2026. This draft is not legal advice and is not approved for production launch.

Scope

This draft covers the ShotRecipe service available at shotrecipe.com. It describes the code-backed processing contract for the current V1 checkpoint.

What the service processes

  • A short video that you choose to upload, plus its size, format, duration, and technical media metadata.
  • A private analysis record, the structured creative breakdown, generated prompt variants, status, and redacted operational metadata.
  • An opaque anonymous-session cookie, a separate analysis-access cookie, and one-way hashes used for access control and abuse limits. ShotRecipe does not store the raw request IP in its analysis database.
  • Optional schema-limited product events only after analytics consent. These events do not contain filenames, video URLs, analysis IDs, access tokens, prompt text, or analysis results.

Why the service processes it

ShotRecipe uses this information to validate and privately analyze the selected video, return a creative breakdown and new prompt templates, prevent abuse, maintain security, diagnose redacted failures, and—only with consent—measure whether the core product flow works.

Service providers and data flow

  • Cloudflare R2 stores the private source video until its deletion deadline.
  • Supabase stores the analysis lifecycle, hashed anonymous-session and quota records, structured results, and redacted provider metadata; it does not store the video binary.
  • Trigger.dev is intended to run the asynchronous worker and scheduled cleanup.
  • Kie's Gemini 3.7 Flash-compatible endpoint receives a short-lived private video URL and the analysis instruction. ShotRecipe does not call Google Gemini directly in V1.
  • PostHog and Google Analytics 4 are optional analytics providers. Their browser code remains blocked until consent; session replay, autocapture, person profiles, advertising signals, and automatic page views are disabled in ShotRecipe's setup.

Retention and automatic deletion

  • The private source video is scheduled to expire after 24 hours. Cleanup runs every 15 minutes; transient deletion failures are retried, so final removal can occur later than the deadline.
  • The structured result and analysis-access cookie expire after 7 days.
  • The essential anonymous-session cookie can last up to 30 days. Daily abuse-control hashes are eligible for purge after 30 days.
  • Worker temporary files are removed when a worker attempt finishes.

There is no self-service early-deletion control in the current product. Do not upload material that requires deletion sooner than the automatic schedule above.

Your choices and rights

You can decline optional analytics and still use the core product. Do not upload a video if you do not agree to the processing described here.

Security and changes

Uploads are private by default and accessed through short-lived signed URLs and scoped cookies. No online service can promise absolute security. Material changes to this notice should update the date above and receive owner or legal review before publication.